fix: bound decode allocation by decoded elements, not remaining bytes

[matthias-wright]

Addresses #314.

Changes:

• types/consensus_state.rs — drop the capacity hint for deposit_queue, protocol_param_changes, added_validators inner, removed_validators, pending_execution_requests
• types/withdrawal.rs — drop it for the schedule pubkeys queue
• types/dynamic_epocher.rs — drop it for segments (kept the existing segments_len == 0 reject)
• Collections now grow on push; the loops already bail on the first EndOfBuffer, so only genuinely decoded elements are ever allocated
• Added 3 regression tests asserting a huge nested count fails cheaply without pre-allocating (consensus_state, withdrawal schedule, dynamic_epocher)

[sebastian-osec]

This looks good to me.

One small remaining allocation-hardening case in the same decoder: captured_bytes still allocates from a decoded length before checking that the buffer actually contains that many bytes:

let len = buf.try_get_u32().map_err(|_| Error::EndOfBuffer)? as usize;
let mut bytes = vec![0u8; len];
buf.try_copy_to_slice(&mut bytes)
    .map_err(|_| Error::EndOfBuffer)?;

A malformed checkpoint/state blob could set has_captured = true and a huge len, causing allocation before the later EndOfBuffer. Could we apply the same guard used for pending_execution_requests here?

if len > buf.remaining() {
    return Err(Error::EndOfBuffer);
}

[matthias-wright]

Update(210a427):

• Bound captured_bytes decode allocation by remaining bytes

[sebastian-osec]

Looks good to me.

I re-checked the broader #314 pattern, and the risky with_capacity(len.min(buf.remaining())) sites appear to be removed from the affected decoders. The remaining length-prefixed byte allocations are guarded before allocation.

Optional test nit: a few of the regression tests stop immediately after the huge count, so buf.remaining() == 0; the old code would also have allocated zero in those exact cases. Adding some trailing bytes would make the tests reproduce the original over-allocation shape more directly.